Switch Source Address Binding Check via Two-Table Lookup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current switch/router security features, such as DHCP snooping and IP source guard, do not adequately check the entire address binding of MAC source address, IP source address, receive port, and receive VLAN, especially in scenarios with multiple hosts or switches, leading to potential mis-configurations and network attacks.
Innovation Solution
A method involving a two-table lookup system where a first table uses a subset of fields to generate a lookup key for a second table, allowing for a comprehensive check of the binding by using a result from the first lookup, reducing the number of bits checked and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DHCP snooping and IP source guard are used, then basic security is provided, but the entire address binding cannot be comprehensively checked
Solution Approach 1:
The binding check process is divided into two sequential lookup operations: a first lookup using a first lookup key (MAC address, port, VLAN) to obtain a first result, and a second lookup using a second lookup key (first result, IP address) to obtain a second result. This segmentation allows comprehensive binding verification while maintaining manageable system complexity through modular table structures.
2Reliability
If full binding check of all address fields is performed, then security against spoofing is improved, but processing overhead increases
Solution Approach 1:
The first lookup is performed preliminarily to retrieve intermediate binding information (layer-2 source index) before performing the second lookup for IP address verification. This preliminary action optimizes the overall process by breaking down the comprehensive binding check into manageable stages, reducing the processing overhead associated with verifying all address fields simultaneously.
3Adaptability or versatility
If multiple hosts in a system are supported, then network versatility is improved, but binding check accuracy becomes more difficult to maintain
Solution Approach 1:
The first lookup result (layer-2 source index) serves as an intermediary that links the MAC address/port/VLAN combination to the expected IP address. This intermediary mechanism enables accurate binding verification across multiple hosts by using the first lookup result as a bridge between layer-2 and layer-3 address information, maintaining precision even in complex multi-host environments.
Data Source
AI summary
In one embodiment, a method can include: (i) receiving a packet in a switch, where the packet includes a plurality of fields that forms a binding; (ii) performing a first lookup of a first table using a first lookup key, where the first lookup key includes a first subset of the plurality of fields; (iii) performing a second lookup of a second table using a second lookup key, where the second lookup key includes a result of the first lookup and a second subset of the plurality of fields; and (iv) indicating a check of the binding by using a result of the second lookup. The plurality of fields can include a media access control (MAC) source address, an internet protocol (IP) address, a receive port, and a receive virtual local area network (VLAN), while the result of the first lookup can include a layer-2 source index, for example.